Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122893
Feedback-ID: id5114917:Fastmail
Content-Type: multipart/alternative;
 boundary="------------FwSbTM052ax5wJzryE081AgF"
Message-ID: <089e6466-540b-4d86-8cf4-1a6b5506efed@rwec.co.uk>
Date: Tue, 2 Apr 2024 20:40:32 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: internals@lists.php.net
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
 <CAPyj-LC9Ygr0vNB3RyTKmmYmq1VbNgzDS_J3bq6NaoXD1YaMhQ@mail.gmail.com>
 <33406173-693c-44c2-a378-fff49751f3b4@rwec.co.uk>
 <CAPyj-LDh7K=cGcxX1qpY7=SYGOdOo0y-QAQjorhRoeqO2ni96A@mail.gmail.com>
Content-Language: en-GB
In-Reply-To: <CAPyj-LDh7K=cGcxX1qpY7=SYGOdOo0y-QAQjorhRoeqO2ni96A@mail.gmail.com>
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")

This is a multi-part message in MIME format.
--------------FwSbTM052ax5wJzryE081AgF
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 02/04/2024 20:02, Ilija Tovilo wrote:
> But, does it matter? I'm not sure we look at some commits closer than
> others, based on its author. It's true that it might be easier to
> identify malicious commits if they all come from the same user, but it
> wouldn't prevent them.


It's like the difference between stealing someone's credit card, and 
cloning the card of everyone who comes into the shop: in the first case, 
someone needs to check their credit card statements carefully; in the 
second, you'll have a hard job even working out who to contact.

Similarly, if you discover a compromised key or signing account, you can 
look for uses of that key or account, which might be a tiny number from 
a non-core contributor; if you discover a compromised account pushing 
unsigned commits, you have to audit every commit in the repository.

I agree it's not a complete solution, but no security measure is; it's 
always about reducing the attack surface or limiting the damage.

Regards,

-- 
Rowan Tommins
[IMSoP]

--------------FwSbTM052ax5wJzryE081AgF
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 02/04/2024 20:02, Ilija Tovilo
      wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAPyj-LDh7K=cGcxX1qpY7=SYGOdOo0y-QAQjorhRoeqO2ni96A@mail.gmail.com">
      <pre>But, does it matter? I'm not sure we look at some commits closer than
others, based on its author. It's true that it might be easier to
identify malicious commits if they all come from the same user, but it
wouldn't prevent them.</pre>
    </blockquote>
    <p><br>
    </p>
    <p>It's like the difference between stealing someone's credit card,
      and cloning the card of everyone who comes into the shop: in the
      first case, someone needs to check their credit card statements
      carefully; in the second, you'll have a hard job even working out
      who to contact.</p>
    <p>Similarly, if you discover a compromised key or signing account,
      you can look for uses of that key or account, which might be a
      tiny number from a non-core contributor; if you discover a
      compromised account pushing unsigned commits, you have to audit
      every commit in the repository.</p>
    <p>I agree it's not a complete solution, but no security measure is;
      it's always about reducing the attack surface or limiting the
      damage.</p>
    <p>Regards,<br>
    </p>
    <pre class="moz-signature" cols="72">-- 
Rowan Tommins
[IMSoP]</pre>
  </body>
</html>

--------------FwSbTM052ax5wJzryE081AgF--